Regulation and data
Ley 2/2023 (whistleblower protection)
Ley 2/2023 of 20 February is the Spanish whistleblower act: it protects people who report breaches of the law and requires private entities with fifty or more workers to have an internal reporting system (art. 10.1.a). The threshold is counted per entity, adding up all its sites, not per building.
Also known aswhistleblower act · whistleblowing law · Ley 2/2023 de protección del informante
When it binds a centre
It transposes Directive (EU) 2019/1937. Its art. 10.1.a binds natural or legal persons in the private sector that have fifty or more workers under contract. The count belongs to the owning entity: a colegio mayor (a Spanish hall of residence with a formative programme) with a small staff does not reach it, and an operator with several residences can reach it even if none does on its own. If it applies, this is what it brings:
- An internal channel in writing, orally or both, that accepts anonymous reports and allows them to be followed up (art. 7.2 and 7.3).
- Acknowledgement within seven calendar days and a reply within three months at most, extendable by three more in particularly complex cases (art. 9.2.c and 9.2.d).
- A System Officer appointed by the governing body, whose appointment and removal are notified within ten working days (art. 8.1 and 8.3).
- Shared resources: entities with between fifty and two hundred and forty-nine workers may share the system (art. 12).
Worth knowing
It is not the same obligation as that of Ley 3/2022. That one arrives through the university and asks for a route for complaints of violence, discrimination or harassment; this one arrives through the headcount and protects people who report breaches. An entity below the threshold may set up its system anyway, meeting the act's requirements (art. 10.2), and the data in each report are processed under the GDPR. The full comparison is in the guide to the reporting channel.
Sources
Related terms
- GDPRThe GDPR is Regulation (EU) 2016/679, the EU rule that governs the processing of personal data. It has applied directly since 25 May 2018, and in Spain the LOPDGDD completes it. It binds a colegio mayor, a private student residence and a coliving in exactly the same way.
- Ley 3/2022 (university community life)Ley 3/2022 of 24 February on university community life is the Spanish act that requires universities to approve community-life rules with measures against violence, discrimination and harassment, and sets the disciplinary regime for students. It never names colegios mayores: it reaches them through their university.